@swc/core
Super-fast alternative for babel
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:request | AI (dependencies): The `request` package is used during install to fetch prebuilt binaries; it is a well-known HTTP client and its use here is consistent with the package's install flow. | ai | |
| install-scripts | install-script:install | AI (install-scripts): @swc/core is a native Rust binding; install script fetches prebuilt binaries or builds via neon. Standard for this package. | ai | |
| phantom-deps | phantom-dep:neon-cli | AI (phantom-deps): neon-cli is used as a CLI tool in install/build scripts, not imported in JS. Expected for neon-based native bindings. | ai | |
| bogus-package | bogus-package | AI (bogus-package): @swc/core is a major ecosystem package (43M downloads); sparse metadata in early versions is not a spam signal. | ai | |
| phantom-deps | phantom-dep:@swc/core-linux-x64-gnu | AI (phantom-deps): Platform-specific optional dependency for NAPI native binding; declared in napi config and loaded conditionally at runtime. | ai | |
| phantom-deps | phantom-dep:@swc/core-linux-x64-musl | AI (phantom-deps): Platform-specific optional dependency for NAPI native binding; declared in napi config and loaded conditionally at runtime. | ai | |
| phantom-deps | phantom-dep:@swc/core-win32-x64-msvc | AI (phantom-deps): Platform-specific optional dependency for NAPI native binding; declared in napi config and loaded conditionally at runtime. | ai | |
| phantom-deps | phantom-dep:@swc/core-linux-arm64-gnu | AI (phantom-deps): Platform-specific optional dependency for NAPI native binding; declared in napi config and loaded conditionally at runtime. | ai | |
| phantom-deps | phantom-dep:@swc/core-win32-ia32-msvc | AI (phantom-deps): Platform-specific optional dependency for NAPI native binding; declared in napi config and loaded conditionally at runtime. | ai | |
| phantom-deps | phantom-dep:@swc/core-linux-arm64-musl | AI (phantom-deps): Platform-specific optional dependency for NAPI native binding; declared in napi config and loaded conditionally at runtime. | ai | |
| phantom-deps | phantom-dep:@swc/core-win32-arm64-msvc | AI (phantom-deps): Platform-specific optional dependency for NAPI native binding; declared in napi config and loaded conditionally at runtime. | ai | |
| phantom-deps | phantom-dep:@swc/core-linux-arm-gnueabihf | AI (phantom-deps): Platform-specific optional dependency for NAPI native binding; declared in napi config and loaded conditionally at runtime. | ai | |
| phantom-deps | phantom-dep:@swc/core-darwin-x64 | AI (phantom-deps): Platform-specific optional dependency for NAPI native binding; declared in napi config and loaded conditionally at runtime. | ai | |
| phantom-deps | phantom-dep:@swc/core-freebsd-x64 | AI (phantom-deps): Platform-specific optional dependency for NAPI native binding; declared in napi config and loaded conditionally at runtime. | ai | |
| phantom-deps | phantom-dep:@swc/core-darwin-arm64 | AI (phantom-deps): Platform-specific optional dependency for NAPI native binding; declared in napi config and loaded conditionally at runtime. | ai | |
| phantom-deps | phantom-dep:@swc/core-android-arm64 | AI (phantom-deps): Platform-specific optional dependency for NAPI native binding; declared in napi config and loaded conditionally at runtime. | ai | |
| provenance | no-provenance | AI (provenance): @swc/core is a long-established, high-trust package; absence of Sigstore provenance is not a risk signal here. | ai | |
| typosquat | typosquat.levenshtein:cors | AI (typosquat): @swc/core is a major scoped package under the @swc org, not a typosquat of 'cors'. The Levenshtein match is purely coincidental and will never be a real signal for this package. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): child_process is used only to run 'ldd --version' to detect musl libc for binary selection; hardcoded, benign, and stable for this package. | ai | |
| phantom-deps | phantom-dep:@swc/counter | AI (phantom-deps): @swc/counter is a same-org runtime dependency declared in package.json dependencies; phantom-dep detection is a false positive here. | ai | |
| install-scripts | install-script:postinstall | AI (install-scripts): @swc/core uses postinstall to select the correct platform-specific prebuilt native binary via NAPI-RS; this is the documented and stable install flow for this package. | ai | |
| semgrep | semgrep:child-process-execsync | AI (semgrep): execSync('ldd --version') is a hardcoded, benign musl detection check in binding.js; stable false positive for this native binding package. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require in index.js loads either a user-specified binding override or ./binding.js; standard NAPI-RS pattern, stable for this package. | ai |
Versions (showing 17 of 217)
| Version | Deps | Published |
|---|---|---|
| 1.2.23 | 4 / 19 | |
| 1.2.22 | 4 / 19 | |
| 1.2.11 | 4 / 18 | |
| 1.2.6 | 4 / 18 | |
| 1.1.58 | 4 / 18 | |
| 1.1.30 | 4 / 17 | |
| 1.1.24 | 4 / 17 | |
| 1.1.15 | 5 / 16 | |
| 1.1.7 | 5 / 14 | |
| 1.1.4 | 5 / 14 | |
| 1.0.40 | 5 / 13 | |
| 1.0.30 | 5 / 13 | |
| 1.0.26 | 5 / 10 | |
| 1.0.18 | 5 / 10 | |
| 1.0.16 | 5 / 10 | |
| 1.0.14 | 5 / 8 | |
| 1.0.12 | 5 / 8 |
v1.2.23
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.2.22
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.2.11
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.2.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.1.58
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.1.30
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.1.24
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.1.15
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.1.7
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.1.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.40
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.30
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.26
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.18
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.16
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.14
2 findingsScript: node scripts/install.js || neon build --release
[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.12
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.